Introduction from CISA Acting Director Gottumukkala
In 2025, CISA approached its mission with a renewed sense of purpose, focusing tightly on the agency’s core mission: protecting America’s critical infrastructure from cyber and physical threats. Our work underscores this continued commitment to efficient, resilient, and modernized operations that ensure the agency is well-positioned to protect our infrastructure, our way of life, and our nation’s people. Just a few examples of our efforts include:
- Cybersecurity: CISA published more than 1,600 products and triaged more than 30,000 incidents reported to CISA’s 24/7 Operations Center to support our nation’s security, providing a proactive approach that strengthens our collective defense and safeguards the systems Americans rely on every day.
- Critical Infrastructure Protection: CISA conducted 148 cyber and physical security exercises with more than 10,000 participants, providing state, local, tribal, and territorial government partners, industry members, and other federal stakeholders with practical mechanisms to examine emergency plans and procedures in action, identify areas for improvement, and implement updates to improve community and national resilience.
- Emergency Communications: CISA improved the resilience of our communications systems and connected 2+ million priority calls for authorized users of the CISA priority telecommunications capability, enabling essential personnel to communicate in emergencies, saving lives, critical infrastructure, and property.
As you read through our highlights from the past year, know that all our work is underpinned by CISA’s relentless pursuit of our core mission. This work relies on our incredibly talented and dedicated team in collaboration with government and industry partners at every level.
Dr. Madhu Gottumukkala
Acting Director
Cybersecurity and Infrastructure Security Agency (CISA)
Staying Ahead of the Threat
CISA continues to expand efforts to increase visibility and proactive hunting for cyber threats to federal agencies by increasing the deployment of Endpoint Detection and Response Persistent Access Capabilities. By enabling continuous, authorized access to agency environments, Persistent Access Capability allows CISA to detect, investigate, and respond to advanced persistent threats and other malicious activity in near real-time.
- In 2025, CISA scaled the deployment of Endpoint Detection and Response to more than 60 agencies with over 500,000 endpoints visible through Persistent Access Capability.
- CISA successfully blocked 2.62 billion malicious connections within the federal civilian network and 371 million malicious connections within critical infrastructure.
CISA advanced its mission to safeguard the nation’s most critical systems by delivering analysis, assessment, planning, and coordination across priority risk areas, including undersea cables, space systems, and information and communications technology supply chains. Through a wide range of high impact classified and unclassified analyses on undersea cable infrastructure and systems, CISA equipped federal agencies and regional partners with actionable insights to drive proactive risk mitigation and resilience planning. This work helped to ensure that the nation remains resilient against evolving threats in an increasingly complex risk environment.
CISA also expanded the CyberSentry Program to 42 voluntary critical infrastructure partners, delivering advanced threat detection and monitoring for networks supporting National Critical Functions. This capability strengthens defenses against sophisticated cyber threats targeting essential services, allowing CISA to support partners to detect and remediate malicious cyber threat activity targeting critical infrastructure.
CISA’s Known Exploited Vulnerabilities Catalog is a trusted resource for federal agencies, state, local, tribal, and territorial governments, and private sector organizations. In FY 2025, CISA added 238 high-risk vulnerabilities to the KEV catalog, enabling agencies to identify and patch threats quickly.
To further reduce risk, CISA assessed and scored 43,000+ vulnerabilities using Stakeholder-Specific Vulnerability Categorization. This decision-tree approach translates complex technical data into clear, actionable priorities—helping information technology teams focus on flaws most likely to be exploited.
Hardening the Terrain
CISA tracks and shares information on the latest cybersecurity threats and best practices to protect our nation against evolving threats and sophisticated cyber actors.
CISA published 42 joint products with federal partners - including 23 with both federal and international partners. These products delivered actionable insights and technical guidance to help partners navigate an increasingly complex threat landscape. These resources safeguard sensitive data, protect critical systems, and ensure operational continuity. For example:
- In August, CISA launched the Software Acquisition Guide: Supplier Response Web Tool, a no-cost, interactive resource that helps government and industry decision-makers embed cybersecurity best practices throughout procurement.
- In September, CISA, in collaboration with the National Security Agency and 19 international partners, launched a Software Bill of Materials for Cybersecurity Guide, enabling organizations to identify components, assess risks, and take informed action to protect critical systems. As modern software increasingly relies on third-party and open-source components, a software bill of materials is essential for managing vulnerabilities and supporting secure-by-design development.
-
In December, CISA launched Cross-Sector Cybersecurity Performance Goals 2.0, giving critical infrastructure owners and operators clear, practical steps to reduce risk. Updated to reflect real-world adversary tactics and the latest National Institute of Standards and Technology Cybersecurity Framework, Cybersecurity Performance Goals 2.0 helps organizations prioritize resources, close critical gaps, and bolster defenses against evolving threats.
In 2021 CISA launched a Vulnerability Disclosure Policy Platform to ensure that federal agencies benefit from the expertise of the research community, through receiving, triaging, and routing vulnerabilities discovered by public security researchers.
In FY 2025, federal agencies participating in CISA's Vulnerability Disclosure Policy Platform service received over 12,800 vulnerability reports from public security researchers, including over 1,200 valid reports, of which agencies remediated 1,099 (90%). CISA also supported four agencies in managing 7 bug bounty programs, through which 28 critical vulnerabilities were identified and over $345k from Federal Agency bounties were awarded to researchers.
The Impact of CISA’s Coordinated Vulnerability Disclosure Program
Cybersecurity risk evolves quickly, and transparency is key to staying ahead. CISA’s Coordinated Vulnerability Disclosure Program identifies, verifies, and coordinates the responsible disclosure of vulnerabilities across critical infrastructure technologies, including information technology, operational technology, industrial control systems, medical devices, Internet of Things, Artificial Intelligence systems, operating systems, and open-source software. By publicly sharing vulnerabilities and mitigation strategies, CISA helps owners and operators reduce risk and protect the systems Americans rely on every day.
In FY 2025, CISA disclosed and helped mitigate vulnerabilities in several high-impact cases, including:
- Medical Devices: Partnered with the Food and Drug Administration to disclose vulnerabilities in foreign-made patient monitors, leading to a manufacturer recall and U.S. import ban
- Ports: Worked with the U.S. Coast Guard to secure vulnerabilities in a system used by 80% of the world’s ports
- Rail: CISA coordinated with major railways and the Department of Transportation to address flaws in train automation protocols.
- Aviation: CISA collaborated with the Federal Aviation Administration to mitigate vulnerabilities in collision avoidance systems used by commercial airlines.
- Military Communications: Responded to vulnerabilities in off-grid mesh radio devices used by U.S. military customers.
These actions underscore CISA’s leadership in transparency and interagency coordination, earning public recognition for protecting critical infrastructure.
In 2025, CISA’s Red Team Capabilities team achieved several critical milestones that advanced the agency’s operational efficiency and helped stakeholders harden their systems.
These milestones include:
- Reduced overall cloud infrastructure costs by 25% through strategic downsizing of the cloud footprint and optimization of usage models, resulting in improved resource allocation.
- Developed multiple zero-day exploits and Common Vulnerabilities and Exposures, which were leveraged to enhance the security and detection capabilities of numerous federal executive branch agencies.
Real World Response: Ready When You Need Us
CISA issued and executed Emergency Directive 25-02: Mitigate Microsoft Exchange Vulnerability on August 7, 2025, to address a post-authentication vulnerability (CVE-2025-53786) in Microsoft Exchange hybrid-joined configurations that allows an attacker to move laterally from on-premises Exchange to the M365 cloud environment. With 97 of 102 agencies reporting, of the 557 in-scope devices across 47 agencies, 93% are running the latest Cumulative Update.
CISA's Cybersecurity Division responded to ongoing, sophisticated cyber campaigns that targeted critical infrastructure and federal agency networks. These threats focused on conducting operations to infiltrate network edge devices, with the likely objective to enable data theft or other cyber espionage activities. CISA led efforts to reduce risks of disruption and espionage to U.S. government networks during Operation THUNDERSTRUCK, a global nation-state adversary campaign targeting Cisco ASA devices.
In response, CISA issued Emergency Directive 25-03, which required federal agencies to identify, analyze, and mitigate potential compromises immediately. As a result, 93% of more than 7,000 in-scope devices across 53 federal agencies were patched or disconnected within 54 days.
CISA also developed and distributed on GitHub the “RayDetect” script, an innovative tool designed to identify compromised Cisco ASA devices. RayDetect is a python script that will detect evidence of execution of the malware “Rayinitiator” on a Cisco ASA device, that helped organizations mitigate compromises on their systems.
During emergencies, connectivity can mean the difference between life and death. CISA ensures communities can communicate when networks are degraded or congested by providing priority telecommunications capabilities, training, and tools. In FY 2025, CISA:
- CISA Priority Telecommunication Services: Connected 2+ million priority calls for authorized users of the CISA priority telecommunications capability. These calls enable essential personnel to communicate when networks were degraded or congested, saving lives, critical infrastructure, and property.
- CISA's Priority Communications Capabilities
- Expanded priority communications capabilities by enrolling almost a quarter million new users. Strengthened collaboration through SAFECOM and the National Council of Statewide Interoperability Coordinators by engaging with 300+ state, local, tribal, and territorial partners to improve emergency communications nationwide.
Securing America
Global-scale events raise the stakes for security. To prepare for the 2026 FIFA World Cup, CISA led - and continues to lead - exercises to ensure readiness across federal, state, local, and private sector partners, strengthening collaboration and operational resilience for one of the world’s largest sporting events.
Key examples include:
- Full-Scale Exercise (Philadelphia): In April 2025, CISA convened 730+ participants from 40+ agencies at Lincoln Financial Field. The exercise produced 15 areas for improvement and 30 actionable recommendations to enhance coordination, communication, and public safety.
- Functional Exercise (Kansas City): A two-day event trained communications personnel in key roles, tested command vehicles, and simulated a severe weather-related mass casualty scenario. Several trainees successfully completed position task books, strengthening emergency communications capabilities.
These efforts underscore CISA’s commitment to safeguarding critical infrastructure and ensuring seamless security operations for global events.
When it comes to securing the nation, the frontlines are in our hometowns. CISA works throughout the year to help local communities build their understanding of their risks and then build resilience through training, exercises, and other activities.
- State, Local, and Tribal Cybersecurity Grants
- On August 1, 2025, the Department of Homeland Security released Notice of Funding Opportunities for the State and Local Cybersecurity Grant Program and the Tribal Cybersecurity Grant Program. These grants provide funding to state, local, territorial, and tribal entities to strengthen their cybersecurity practices and resilience and address cybersecurity risks and threats to their information systems. Both programs are administered by FEMA with substantial support from CISA. These grants make available more than $91.7 million to states and territories and $12.6 million to Tribal Governments to address cybersecurity risks.
- Protecting Communities from Explosives
- Physical security remains a no-fail mission. In 2025, CISA delivered 1,057 counter-improvised explosive device and risk mitigation training courses to more than 25,000 participants, enhancing threat awareness, preparedness, and capabilities. 94% indicated the training enhanced their preparedness to perform their jobs.
- Through the Empowered Trainer Program, CISA prepared state, local, tribal, and territorial and private sector partners to deliver counter-improvised explosive device training locally. The program sustained 118 active trainers from 53 organizations across 27 states, who delivered 376 courses to 6,136 participants, multiplying impact and strengthening community resilience.
- Active Shooter
- Delivered 58 Active Shooter Preparedness webinars/workshops with more than 14,000 registrants; 93% indicated the training will inform risk-based decisions.
- Conflict Prevention
- Conducted 14 Conflict Prevention webinars with 7,200 registrants; 87% indicated the training will greatly improve prevention capabilities.
- Protecting K-12 Education
- CISA operates and manages SchoolSafety.gov, the federal hub for school safety guidance, best practices, and funding opportunities. In Fiscal Year 2025, we:
- Hosted 45 training events for 10,000+ school leaders to create safe learning environments;
- Added 102 new resources and launched a new topic on Substance Abuse Prevention;
- Promoted 80+ funding opportunitiesto address schools’ unique safety needs; and
- Established the Federal School Safety Clearinghouse External Advisory Board to strengthen collaboration.
- CISA operates and manages SchoolSafety.gov, the federal hub for school safety guidance, best practices, and funding opportunities. In Fiscal Year 2025, we:
- Exercises
- CISA conducts regular cyber and physical exercises with private and public sector partners at the state and federal levels to enhance the security and resilience of our nation. These exercises allow CISA and our partners an effective, practical mechanism to examine their plans, identify areas for improvement, and inform future planning, training, and education efforts to better position us to respond to real-world incidents.
- In FY 2025, CISA conducted multiple exercises to test and improve emergency response efforts, including:
- Spectrum Cyclone (Seattle): Simulated radio frequency interference, cyberattacks, and crowd surges during a major event.
- Phoenix Fuel Supply Chain: Convened 60+ partners for a multi-day tabletop exercise to strengthen fuel infrastructure resilience.
- 148 cyber and physical security exercises with more than 10,000 participants. 94% reported improved preparedness, and 96% would recommend similar exercises.
- Infrastructure and Cybersecurity Assessments
- Each critical infrastructure sector faces unique risks. The Sector Risk Management Agencies are subject matter experts to help drive down risk for sectors like food and agriculture, transportation, water and wastewater, and others. CISA shared more than 2,500 threat and incident reports, coordinated intelligence across the federal government, and partnered through structured meetings and threat briefings to strengthen resilience nationwide.
- Additionally, CISA delivered 400 infrastructure security assessments to stakeholders identifying facilities’ security and protective measures, dependencies related to preparedness and resilience, and recommendations to address security and resilience challenges.
Innovating to Fuel the Mission
In July, CISA launched the Eviction Strategies Tool to help defenders quickly contain and evict cyber adversaries. This two-part solution includes:
- Playbook-Next Generation: A web app that generates customized incident response playbooks in minutes.
- COUN7ER: A database of 100+ atomic countermeasures mapped to MITRE ATT&CK™, D3FEND™, and other best practices.
The Adversary Eviction Strategies Tool accelerates response planning, supports multiple incident types, and exports playbooks in formats like JSON, Word, and Excel, making integration seamless and improving defenders’ ability to act fast.
While most Unmanned Aircraft System activity is harmless, undetected flights can pose security risks. Following Executive Order 14305, “Restoring American Airspace Sovereignty,” CISA published the Be Air Aware™ suite of security guides in November 2025 to help organizations detect, respond to, and safely manage Unmanned Aircraft System threats. These resources provide practical steps for planning and protecting facilities from unauthorized drone activity.
To accelerate innovation, CISA introduced the Industry Engagement Platform. This tool creates a direct channel for industry to share emerging cybersecurity and infrastructure solutions with CISA. Through the Industry Engagement Platform, partners can request meetings with subject matter experts, upload capability overviews, and connect with the right audiences.
- Launched on December 4, 2025, in its first month CISA approved 134 access requests.
- Industry organizations created 113 new organization profiles and completed 16 capability briefings, helping CISA stay ahead of evolving threats and market trends.
In July, CISA launched Thorium, an automated, scalable malware and forensic analysis platform that can integrate commercial, custom and open-source analysis tools and enable cyber defenders to automate their existing analysis workflows through simple tool integration and intuitive event driven triggers.
Modernizing to Scale Security and Shrink Costs
Building on lessons learned from the 2020 SolarWinds campaign, CISA embarked on an initiative to build its own enterprise ecosystem, segmented from the rest of the federal government ecosystem. This new infrastructure delivered a win for federal cybersecurity by enhancing CISA's security and streamlining data processing that can deliver greater cybersecurity insights into the broader cyber threat landscape. By being at the top of our game internally, CISA is better positioned to strengthen the nation's cybersecurity.
CISA also launched new tools to streamline spending and automate processes which helped to save time, reduce administrative burden, and optimize resources. Through the Continuous Diagnostics and Mitigation Program, 54 agencies migrated to a Dashboard-as-a-Service model, lowering hosting costs and accelerating updates to federal end-users to improve their cyber posture awareness.
Looking Ahead
CISA is ready for the new challenges 2026 will bring, and we are excited to continue working with our government and private sector partners to strengthen our cyber defenses and protect our critical infrastructure. In doing so, CISA will remain committed to our core mission to ensure cybersecurity, infrastructure security, and emergency communications are all defended with efficient, proactive, and modern approaches – keeping our networks, our communities, and our people safe.
